Zero content retention by default
Standard synchronous API prompts and responses are not persisted by the Ofox gateway unless the team turns on request logs.
OfoxAI Trust Center
Security you can build on.
OfoxAI, operated by NICE TALK PTE. LTD., brings our current security, privacy, data-handling and reliability information together in one place.
Last reviewed:
Encrypted transport
TLS protects customer-to-Ofox and Ofox-to-provider connections.
Protected API keys
Keys are shown once, verified by hash, and support rotation, revocation and IP allowlists.
99.9% availability
Live platform and model-route health is published on the Ofox status page.
Data handling
What Ofox stores
Retention follows the feature. Standard API traffic is transient by default; features that must resume a job or return a result keep the minimum information needed to do that.
01
Standard model API
Zero retention by defaultCustomer content
Prompts and responses are processed to complete the request and are not persisted by the Ofox gateway by default. If a team owner or admin turns on request logs, prompts and responses from the keys in scope are kept for up to the latest 3 days, 10,000 requests or 1 GB, with credentials replaced by [REDACTED] before saving; personal data such as emails and phone numbers is not removed.
Operational records
Account and key identifiers, model/provider, tokens, cost, latency, status and errors may be retained to operate and protect the service. Only team owners and admins can view, export and delete saved request logs.
02
Playground
Browser-first historyCustomer content
Text turns stay in the active page. The latest image or video turn may be saved in the signed-in user's browser for up to 24 hours so a result or running job can be recovered.
Temporary results
Generated media, task IDs and result links may use temporary storage while the result remains available for recovery or download.
03
Video and async jobs
Feature-required retentionCustomer content
Prompts, request parameters and result references are retained while an asynchronous job is processed and made available to the account.
Job records
Task state, provider, usage, cost, errors and result metadata support processing, retrieval and billing.
Controls
Current technical controls
Zero Data Retention (ZDR)
By default, standard API prompt and response content is processed transiently and excluded from gateway message logs and persistent prompt storage. Error handling redacts message content. Request logs are off by default and opt-in per team.
Key protection
API keys are verified by hash, can be rotated and revoked, and can be limited by source IP and model — set once for the team and narrowed further per key.
Encrypted request path
TLS protects API traffic from the customer to Ofox and from Ofox to the selected provider.
Access protection
Rate limits, bot protection and identity-aware controls protect public and administrative surfaces.
Provider-aware routing
Requests follow the active model route; supported paths also accept an explicit fallback-model list.
Public service status
Platform and individual model-route health is available at status.ofox.ai.
ISO/IEC 27001
Certified
Certification
ISO/IEC 27001:2022 certified
NICE TALK PTE. LTD., the company that operates OfoxAI, holds ISO/IEC 27001:2022 certification for its information security management system.
Certificate details are available on request for security reviews: hi@ofox.ai.
Compliance
GDPR compliant
OfoxAI follows the GDPR requirements that apply to the personal data we process, including data minimization, purpose limitation, security safeguards and support for data-subject rights.
- Access, correction and deletion requests
- Documented provider and processing disclosures
- Privacy contact: hi@ofox.ai
Singapore data protection
Singapore PDPA
OfoxAI is operated by Singapore-incorporated NICE TALK PTE. LTD. Individuals can submit access, correction, deletion or consent-withdrawal requests through hi@ofox.ai.
Payment security
Handled by PCI DSS Level 1 providers
Card details are collected and processed through hosted checkout services operated by Stripe or Airwallex. Ofox does not store full card numbers or security codes, retaining only order records and limited payment metadata.
Reliable by design, visible in public
OfoxAI publishes 99.9% availability for its platform. Current platform and model-route health is available on the public status page.
Trust resources
Need a security or privacy answer?
Talk to us about security reviews, data handling or a privacy-rights request.